Add Null check in LegacyAbstractInlineTextBox::TextOffsetInContainer

A call to DynamicTo<Text> where "from" is a HTMLBRElement will
return null.
We need to be able to handle this condition, so a null check was
added before "text_node" is dereferenced.

Bug: 928948
Change-Id: I5d27b63e905035c8d12d41bf3d2a86adc5a82bbf
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2031937Reviewed-by: Kurt Catti-Schmidt <kschmi@microsoft.com>
Reviewed-by: Koji Ishii <kojii@chromium.org>
Commit-Queue: Jacques Newman <janewman@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#738635}

third_party/blink/renderer/core/layout/line/abstract_inline_text_box.cc

@@ -305,6 +305,8 @@ bool LegacyAbstractInlineTextBox::IsLineBreak() const {
 
 const NGOffsetMapping* LegacyAbstractInlineTextBox::GetOffsetMapping() const {
   const auto* text_node = DynamicTo<Text>(GetNode());
+  if (!text_node)
+    return nullptr;
 
   LayoutBlockFlow& block_flow = *NGOffsetMapping::GetInlineFormattingContextOf(
       *text_node->GetLayoutObject());

third_party/blink/renderer/core/layout/line/abstract_inline_text_box_test.cc

@@ -116,9 +116,10 @@ TEST_P(AbstractInlineTextBoxTest, GetTextWithLineBreakAtTrailingWhiteSpace) {
 
 TEST_P(AbstractInlineTextBoxTest, GetTextOffsetInContainer) {
   // "&#10" is a Line Feed ("\n").
-  SetBodyInnerHTML(
-      R"HTML(<style>p { white-space: pre-line; }</style>
-      <p id="paragraph">First sentence of the &#10; paragraph. Second sentence of &#10; the paragraph.</p>)HTML");
+  SetBodyInnerHTML(R"HTML(
+    <style>p { white-space: pre-line; }</style>
+    <p id="paragraph">First sentence of the &#10; paragraph. Second sentence of &#10; the paragraph. </p>
+    <br id='br'>)HTML");
 
   const Element& paragraph = *GetDocument().getElementById("paragraph");
   LayoutText& layout_text =
@@ -145,6 +146,13 @@ TEST_P(AbstractInlineTextBoxTest, GetTextOffsetInContainer) {
   inline_text_box = inline_text_box->NextInlineTextBox()->NextInlineTextBox();
   EXPECT_EQ("the paragraph.", inline_text_box->GetText());
   EXPECT_EQ(52u, inline_text_box->TextOffsetInContainer(0));
+
+  // Ensure that calling TextOffsetInContainer on a br gives the correct result.
+  const Element& br_element = *GetDocument().getElementById("br");
+  LayoutText& br_text = *ToLayoutText(br_element.GetLayoutObject());
+  inline_text_box = br_text.FirstAbstractInlineTextBox();
+  EXPECT_EQ("\n", inline_text_box->GetText());
+  EXPECT_EQ(0u, inline_text_box->TextOffsetInContainer(0));
 }
 
 }  // namespace blink